What to do in a cyberattack: a household guide based on CISA, FTC and FBI advice

What counts as a cyberattack at home

Ready.gov says "cyberattacks are malicious attempts to access or damage a computer or network system," and that they can occur in many ways, including accessing your personal computers, mobile phones and gaming systems, identity theft, and blocking your access to or deleting your accounts. For a household that can look like: a phishing message that tricks you into giving up a password, a hacked email or bank account, a scam, ransomware that locks your files, or personal data stolen from a company you deal with.

CISA, the federal Cybersecurity and Infrastructure Security Agency, describes ransomware as "an ever-evolving form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption."

Before: CISA's four core steps

CISA's Secure Our World program says: "Everyone should take these 4 core steps: Avoid and report phishing scams. Use strong passwords. Use multifactor authentication and a password manager. Update software."

On passwords, CISA says to use "at least 16 characters," to "make them random," and to use "a different strong password for each account," and that a password manager helps create long, random, unique passwords. On multifactor authentication (MFA), it says MFA confirms your identity with something like a code texted to a phone or one from an authenticator app, so that "even if an unauthorized user steals your password, they won't be able to meet the second step requirement to access your accounts." On updates, it says to "install updates as soon as possible" and to turn on automatic updates. On phishing, CISA says "if a message looks suspicious, it's probably phishing," and lists urgent language or messages that "claim dire consequences for not responding immediately" as warning signs. Its tips are recognize, resist and delete.

Ready.gov adds: back up your files regularly in an encrypted file or encrypted file storage device. CISA's ransomware advice also says to "maintain offline, encrypted backups of data and regularly test your backups."

During: limit the damage

Ready.gov's advice for when you think you have been hit: "Check your credit card and bank statements for unrecognizable charges." "If you notice strange activity, limit the damage by changing all of your internet account passwords immediately." "If you find a problem, disconnect your device from the Internet and perform a full system restore." It also warns: "A company will not call you and ask for control of your computer to fix it. This is a common scam."

Our own suggestion: change passwords from a device you trust, not the one that may be affected, and start with email and banking.

After: protect your identity and report it

Ready.gov's list for afterward includes: file a complaint with the FBI Internet Crime Complaint Center (IC3), report identity theft to the Federal Trade Commission, file a report with local police so there is an official record, and contact banks, credit card companies and other financial companies where you hold accounts. It says "you may need to place holds on accounts that have been attacked" and to "close any unauthorized credit or charge accounts."

On the IC3 site, the FBI says: "File a report to share information with the FBI." It calls IC3 "the main intake form for a variety of complaints" and says to "file a report even if you are unsure of whether your complaint qualifies." CISA's ransomware page says victims "should report to federal law enforcement via IC3 or a Secret Service Field Office."

The FTC says: "If you think someone stole your identity, report it to the Federal Trade Commission. You'll get a free personal recovery plan with next steps," at IdentityTheft.gov. If you got a breach notice and your Social Security number was exposed, the FTC's video says to order your free credit reports and check for accounts you do not recognize, and that you might also place a credit freeze or fraud alert.

Credit freezes and fraud alerts

The FTC says: "When a credit freeze is in place, nobody can open a new credit account in your name. There's no cost to place or lift a credit freeze, and it doesn't affect your credit score." It adds that "anyone can freeze their credit report, for any reason, even if their identity hasn't been stolen," that a freeze lasts until you lift it, and that you place one by contacting all three credit bureaus: Equifax, Experian and TransUnion.

An initial fraud alert is free, lasts one year and can be renewed. You contact one of the three bureaus, and it must tell the other two. "Unlike a credit freeze, a fraud alert doesn't prevent businesses from seeing your credit report." An extended fraud alert lasts seven years and needs an FTC identity theft report or a police report. If your child is under 16, the FTC says you can request a free credit freeze for them.

When a cyberattack takes out power, phones or banks

Some attacks target infrastructure rather than people. Ready.gov lists effects of power outages that include disrupting communications, water and transportation, and closing stores, gas stations, ATMs and banks. Its financial advice is: "Keep a small amount of cash at home in a safe place. It is important to have small bills on hand because ATMs and credit cards may not work during a disaster." It also says to store important documents in a safety deposit box, on an external drive or in the cloud.

Beyond that, the plan is the one for any outage: our power outage checklist, and a battery radio for news. Ready.gov's safety lines apply: "Generators and fuel should always be used outdoors and at least 20 feet away from windows, doors and attached garages" and "Never use a gas stovetop or oven to heat your home." For the bigger picture of how the grid is built, see could a national blackout happen.